After the ransomware attack on a large IT provider in Sweden last week, many managers are asking the same question: What should we have demanded from our provider?<\/p>\n
Here is my list.<\/p>\n
Separation. Your environment should be separated from other customers, technically and administratively. Ask how many of the provider\u00b4s admins can reach your systems, and whether an attacker who gets into one customer can reach the next.<\/p>\n
Protected administration. The provider\u00b4s admin accounts and admin devices are Tier 0 for you. Demand a second factor, dedicated admin workstations and just in time access.<\/p>\n
Backups you control. Demand copies of your data that are stored separately, can\u00b4t be deleted by the provider\u00b4s admins and are regularly tested for restore.<\/p>\n
Transparency. The right to see the logs of what the provider does in your environment, and the right to audit. Notification within hours when they have an incident, even before they know if you are affected.<\/p>\n
Continuity. A documented and tested plan for how your critical services are restored, in what order and how fast. And a plan for how you can leave the provider if you need to.<\/p>\n
Price it in. All of this costs money, and the cheapest bid usually doesn\u00b4t include it. Put the requirements in the procurement, not in a later negotiation.<\/p>\n
The new rules in the NIS2 directive will soon make many of these requirements mandatory anyway. Start now.<\/p>\n
Choose your provider like you choose your bank. You are trusting them with your business.<\/p>\n","protected":false},"excerpt":{"rendered":"
After the ransomware attack on a large IT provider in Sweden last week, many managers are asking the same question: What should we have demanded from our provider? Here is my list. Separation. Your environment should be separated from other customers, technically and administratively. Ask how many of the provider\u00b4s admins can reach your systems, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,44,137],"class_list":["post-1416","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-contracts","tag-supply-chain"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1416","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1416"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1416\/revisions"}],"predecessor-version":[{"id":1463,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1416\/revisions\/1463"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1416"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1416"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1416"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}